Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

herrjemand.medium.com

Post reply on HN
Print view View original

1–10 of 294 posts

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#4

Post by BillinghamJ »

sdfhbdf wrote: post #3

The idea to replace CAPTCHA with FIDO doesn't seem sound, isn't it trivial to imitate it with DevTools in Chrome or some other software? https://developer.chrome.com/docs/devtools/webauthn/

The attestation process is capable of cryptographically checking the device manufacturer etc

(although practically I'm unsure as to whether that's really a good idea or would work well)

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#5

Post by arsome »

sdfhbdf wrote: post #3

The idea to replace CAPTCHA with FIDO doesn't seem sound, isn't it trivial to imitate it with DevTools in Chrome or some other software? https://developer.chrome.com/docs/devtools/webauthn/

I believe the idea here is you need to buy actual FIDO U2F keys and they could then be revoked on a per-key basis if you're caught abusing them as they're signed by a 3rd party so can't just be emulated.

Meaning you need to buy more. Makes it expensive at least.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#6

Post by Nextgrid »

arsome wrote: post #5
sdfhbdf wrote: post #3

The idea to replace CAPTCHA with FIDO doesn't seem sound, isn't it trivial to imitate it with DevTools in Chrome or some other software? https://developer.chrome.com/docs/devtools/webauthn/

I believe the idea here is you need to buy actual FIDO U2F keys and they could then be revoked on a per-key basis if you're caught abusing them as they're signed by a 3rd party so can't just be emulated. Meaning you need to buy more. Makes it expensive at least.

How can you revoke on a per-key basis without at the same time being able to track keys uniquely?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#7

Post by kylehotchkiss »

I’d rather take these tradeoffs than doing 5 steps of Recaptcha because I’m using a VPN to work, which as Cloudflares announcement said, is very localized to North America and likely extra complicated for those outside the region.

In theory, couldn’t Yubikey begin reducing batch sizes to 1,000 and Cloudflare mark specific batch numbers as requiring one extra step to verify? The vast majority of Yubikey sales will be for real people in any case.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#8

Post by sdfhbdf »

arsome wrote: post #5
sdfhbdf wrote: post #3

The idea to replace CAPTCHA with FIDO doesn't seem sound, isn't it trivial to imitate it with DevTools in Chrome or some other software? https://developer.chrome.com/docs/devtools/webauthn/

I believe the idea here is you need to buy actual FIDO U2F keys and they could then be revoked on a per-key basis if you're caught abusing them as they're signed by a 3rd party so can't just be emulated. Meaning you need to buy more. Makes it expensive at least.

But i'm specifically asking about software. I know Touch ID can be used with WebAuthn and also see the DevTools in chrome WebAuthn debugger. Just seems easy to fool when I regenerate a key on every visit unless there is additional step I don't get.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#10

Post by arsome »

There's always CAPTCHA bypasses if you're willing to pay, there've been sites operating for decades that will take a captcha URL and spit out the appropriate response by just feeding it to humans. This is just a different way to make you pay - and arguably to something of less ill-repute, buying more U2F keys once yours get banned.

This provides effective rate limiting and you can still get every key you automate banned very easily.

Post reply on HN